CVE-2026-57654
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Affiliates Manager plugin version 2.9.49 and earlier suffers from a broken access control vulnerability for affiliates. This allows unauthorized users to perform actions they should not have permission to.
Risk Assessment
The organization is at risk of unauthorized access to affiliate functions, potentially leading to data manipulation, commission theft, or privilege escalation within the system.
Recommendation
Immediately update the Affiliates Manager plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin until it is released.
Other vulnerabilities in Affiliates Manager
See all- CVE-2026-73355Critical
Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.
- CVE-2026-73358High
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
- CVE-2026-52692High
Versions of Affiliates Manager up to 2.9.50 have a vulnerability that allows unauthorized access to sensitive data.
Original NVD description (English source)
Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.